@portll/cobolwork 0.3.0 → 0.5.0

package/rules/compliance-cobit2019.json

@@ -1522,6 +1522,150 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "cobit-2019",
+   "clause": "BAI09.01",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is a component the record of assets does not account for, which this practice requires be identified and recorded.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "cobit-2019",
+   "clause": "BAI09.01",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is a component the record of assets does not account for, which this practice requires be identified and recorded.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "cobit-2019",
+   "clause": "DSS06.06",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That is information released to people it was never meant for, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "cobit-2019",
+   "clause": "DSS06.06",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That is information released to people it was never meant for, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "cobit-2019",
+   "clause": "DSS06.06",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That is information released to people it was never meant for, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: An input the program accepts ends its run with an abend. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-s0c4",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: An input the program accepts ends its run with a protection exception (S0C4). That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-s0c7",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: An input the program accepts ends its run with a data exception (S0C7). That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-subscript-range",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: An input the program accepts drives a subscript or reference modification out of range, and the run abends. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "intermediate-result-loses-high-order-digits",
@@ -1954,6 +2098,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2254,6 +2410,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "cobit-2019",
+   "clause": "DSS05.02",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is information or a credential crossing a connection with nothing protecting it, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2278,6 +2446,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",

package/rules/compliance-dora.json

@@ -1640,6 +1640,162 @@
     "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "dora",
+   "clause": "Article 8(4)",
+   "title": "Identification",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is an interdependency between assets which no single file records, and mapping it is what this clause asks for.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "dora",
+   "clause": "Article 9(4)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That grants or alters access rights outside the policy controls this clause requires be soundly administered.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "dora",
+   "clause": "Article 9(3)(b)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is a technical flaw permitting unauthorised access or data corruption, which this clause requires be minimised.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "dora",
+   "clause": "Article 8(4)",
+   "title": "Identification",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is an interdependency between assets which no single file records, and mapping it is what this clause asks for.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "dora",
+   "clause": "Article 9(4)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That grants or alters access rights outside the policy controls this clause requires be soundly administered.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "dora",
+   "clause": "Article 9(3)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That risks the loss of data and the impairment of its integrity, which this clause requires be prevented.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "dora",
+   "clause": "Article 9(3)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That risks the loss of data and the impairment of its integrity, which this clause requires be prevented.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "dora",
+   "clause": "Article 9(3)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That risks the loss of data and the impairment of its integrity, which this clause requires be prevented.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend",
+   "framework": "dora",
+   "clause": "Article 9(3)(b)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: An input the program accepts ends its run with an abend. That is a technical flaw permitting unauthorised access or data corruption, which this clause requires be minimised.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-s0c4",
+   "framework": "dora",
+   "clause": "Article 9(3)(b)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: An input the program accepts ends its run with a protection exception (S0C4). That is a technical flaw permitting unauthorised access or data corruption, which this clause requires be minimised.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-s0c7",
+   "framework": "dora",
+   "clause": "Article 9(3)(b)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: An input the program accepts ends its run with a data exception (S0C7). That is a technical flaw permitting unauthorised access or data corruption, which this clause requires be minimised.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-subscript-range",
+   "framework": "dora",
+   "clause": "Article 9(3)(b)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: An input the program accepts drives a subscript or reference modification out of range, and the run abends. That is a technical flaw permitting unauthorised access or data corruption, which this clause requires be minimised.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "intermediate-result-loses-high-order-digits",
@@ -2108,6 +2264,19 @@
     "quote": "implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "dora",
+   "clause": "Article 9(4)(d)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That exposes an authentication secret in a file, defeating the authentication mechanisms and key protection this clause requires.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2459,6 +2628,19 @@
     "quote": "implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "dora",
+   "clause": "Article 9(3)(a)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is data leaving through a channel the program opened itself, which bears directly on the security of the means of transfer.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "ensure the security of the means of transfer of data"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2485,6 +2667,19 @@
     "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "dora",
+   "clause": "Article 9(3)(b)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is a technical flaw permitting unauthorised access or data corruption, which this clause requires be minimised.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",

package/rules/compliance-ffiec.json

@@ -1649,6 +1649,162 @@
     "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "ffiec",
+   "clause": "DA&M IV",
+   "title": "Common Development, Acquisition, and Maintenance Practices",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Inventory of all systems and components (e.g., open-source, proprietary, application programming interfaces [API], and container images and registries), including related licenses, and data as part of IT asset management (ITAM)."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "ffiec",
+   "clause": "IS II.C.7",
+   "title": "User Security Controls",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That is authority granted or exercised beyond job necessity, which the principle of least privilege exists to constrain.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Principle of least privilege, which recommends minimum user profile privileges for both physical and logical access based on job necessity."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "ffiec",
+   "clause": "DA&M IV",
+   "title": "Common Development, Acquisition, and Maintenance Practices",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Inventory of all systems and components (e.g., open-source, proprietary, application programming interfaces [API], and container images and registries), including related licenses, and data as part of IT asset management (ITAM)."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "ffiec",
+   "clause": "IS II.C.7",
+   "title": "User Security Controls",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is authority granted or exercised beyond job necessity, which the principle of least privilege exists to constrain.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Principle of least privilege, which recommends minimum user profile privileges for both physical and logical access based on job necessity."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: An input the program accepts ends its run with an abend. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-s0c4",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: An input the program accepts ends its run with a protection exception (S0C4). That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-s0c7",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: An input the program accepts ends its run with a data exception (S0C7). That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-subscript-range",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: An input the program accepts drives a subscript or reference modification out of range, and the run abends. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "intermediate-result-loses-high-order-digits",
@@ -2117,6 +2273,19 @@
     "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2442,6 +2611,19 @@
     "quote": "Principle of least privilege, which recommends minimum user profile privileges for both physical and logical access based on job necessity."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2468,6 +2650,19 @@
     "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",